Insurance Daily News

French Supermarket Hack Exposes Cyber-Property Insurance Gap

A recent cyberattack targeting internet-connected refrigeration controllers in France has created significant uncertainty regarding insurance coverage for physical stock losses. Between October 11 and 12, attackers compromised controllers at approximately 700 supermarkets, forcing prolonged defrost cycles that caused food spoilage and, in some instances, fires. The compromised equipment, manufactured by Danfoss, was reportedly running outdated firmware.

The incident has triggered claims against property insurance policies, which typically include coverage for refrigeration spoilage. However, these policies often contain cyber exclusions, leading to potential disputes over whether losses resulting from malicious digital interference are recoverable. Claims professionals are now tasked with determining the precise cause of loss, as the presence of a cyberattack does not automatically trigger a property exclusion. If an investigation confirms the damage resulted from sabotage or malicious software, insurers may deny property claims based on these exclusions.

Standalone cyber policies may not provide a solution, as they generally focus on incident response and data restoration rather than physical damage. Furthermore, potential war exclusions could complicate claims if a state actor is identified as the perpetrator. The financial impact is already evident; Lockton reported that refrigeration failures resulted in €270,000 in stock losses at just two locations. This event underscores the growing risk as building systems, including heating and ventilation, are increasingly managed through remote, internet-connected technology that may lack modern security updates.

For brokers, this incident serves as a critical reminder to review the interaction between property and cyber coverage for clients in retail, food, hospitality, and pharmaceutical sectors. It is essential to verify if property spoilage clauses include cyber exclusions and whether cyber policies specifically address physical stock damage or perishable goods.

Why it matters

This incident highlights a critical coverage gap where physical damage caused by cyber events may fall between traditional property and cyber policies, necessitating a proactive review of policy wordings.

FAQ

What caused the refrigeration failures in French supermarkets?
Attackers gained control of internet-connected refrigeration controllers, triggering defrost cycles that heated freezers and caused stock spoilage and fires.

Why is it difficult to claim for these losses?
Property policies often cover spoilage but contain cyber exclusions, while cyber policies typically exclude physical loss, creating a potential coverage gap.

How many stores were affected by the attack?
The attack affected up to 700 French supermarkets.

Source: Insurance Business UK. See the original source for full details.